Security

Link

Hacking US Diplomats in Uganda May Have Led to NSO Group Downfall

Andrew Orr ·

ArsTechnica shares the story of how U.S. diplomats in Uganda were hacked by Pegasus, a spyware tool from NSO Group.

Israeli and US officials declined to confirm that the Ugandan hack directly triggered a decision to blacklist NSO. But one US official who discussed the issue with Israel’s defense ministry said: “Look at the entire sequence of events here—this is careful, not by chance.” He added that putting NSO, one of the jewels of Israel’s tech community, on a US blacklist was designed to “punish and isolate” the company.

Link

'Have I Been Pwned' Completes FBI Ingestion Pipeline for Passwords

Andrew Orr ·

Troy Hunt, creator of Have I Been Pwned, has completed a pipeline that enables the ingestion of passwords from law enforcement agencies, like the FBI.

The premise is simple: during the course of their investigations, they come across a lot of compromised passwords and if they were able to continuously feed those into HIBP, all the other services out there using Pwned Passwords would be able to better protect their customers from account takeover attacks. Fast forward to now and that ingestion pipeline is finally live.

‘Cryptomator’ 2.0 is Here and it Integrates Into iOS Files App
Cool Stuff Found

'Cryptomator' 2.0 is Here and it Integrates Into iOS Files App

Andrew Orr ·

The team behind Cryptomator has rewritten the app in Swift, and with version 2.0 the app is completely integrated into the Files app. This means that your vaults are directly accessible from there. For example, you can now save and edit a Word document directly in an encrypted vault via the Files app. In addition, features like thumbnails, grid view, swiping through images, and drag & drop are possible with the new app. To summarize, Cryptomator gives you end-to-end encryption for your files. You can store them in Google Drive, iCloud Drive, Dropbox, and more. You can also store them offline in the Files app or on a hard drive.

Link

Explaining 'log4j' and Why it's a Serious Cybersecurity Threat

Andrew Orr ·

In early December a cybersecurity threat was discovered with the popular “log4j” utility. The Post has a good piece on the exploit, explained in non-jargon.

The fact that log4j is such a ubiquitous piece of software is what makes this such a big deal. Imagine if a common type of lock used by millions of people to keep their doors shut was suddenly discovered to be ineffective. Switching a single lock for a new one is easy, but finding all the millions of buildings that have that defective lock would take time and an immense amount of work.

Link

Wi-Fi Gateway From Airangel Affects Hundreds of Hotels

Andrew Orr ·

Security researcher Etizaz Mohsin says that the Airangel HSMX Gateway, used by many hotels to offer Wi-Fi to guests, contains hardcoded passwords that are easy to guess.

With those passwords, which we are not publishing, an attacker could remotely gain access to the gateway’s settings and databases, which store records about the guest’s using the Wi-Fi. With that access, an attacker could access and exfiltrate guest records, or reconfigure the gateway’s networking settings to unwittingly redirect guests to malicious webpages, he said.

Link

Sennheiser Leak Exposed 55GB of Data for Thousands of Customers

Andrew Orr ·

Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a cache of data from audio company Sennheiser. It appears to be from an old cloud account that’s been dormant since 2018. Over 28,000 Sennheiser customers were exposed, with sensitive private data leaked.

While it’s unclear how all this data was collected, it appears to be from customers and businesses requesting samples of Sennheiser products.

Examples of entries: Full names, Email addresses, Phone numbers, Home addresses, Names of companies requesting samples, Number of the requesting company’s employees

Link

US Logistics Company 'D.W. Morgan' Leaks Data Through Amazon S3

Andrew Orr ·

A report from Website Planet reveals D.W Morgan left an Amazon S3 bucket unprotected, resulting in the exposure of over 2.5 million files.

An Amazon S3 bucket owned by D.W. Morgan was left accessible without authorization controls in place, exposing sensitive data relating to shipments and the company’s clients.

As a market leader, D.W. Morgan provides services to some of the biggest companies in the world and there are major Fortune 500 organizations with data exposed on the open bucket.

Link

Google's Project Zero Deep Dives into NSO Group 'FORCEDENTRY' Exploit

Andrew Orr ·

Google’s Project Zero security team published a deep dive into FORCEDENTRY, a zero-click exploit in iMessage used by NSO Group. Apple’s Security Engineering and Architecture (SEAR) group collaborated on the analysis.

Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we’ve ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.

The vulnerability discussed in this blog post was fixed on September 13, 2021 in iOS 14.8 as CVE-2021-30860.

Link

iCloud, Twitter, MineCraft, Cloudflare, All Vulnerable to a Powerful Bug

Andrew Orr ·

According to a report on Friday, major apps and services such as iCloud, Cloudflare, Steam, Twitter, and others are vulnerable to a bug.

On Thursday, researchers noticed that a popular Java logging library (log4j) had a bug that allows for Remote Code Execution or RCE, hacker lingo for one of the most dangerous types of vulnerabilities, one that essentially allows hackers to take control of the target. GitHub labeled the vulnerability as “critical severity,” and many researchers, as well as the Director of Cybersecurity at the NSA, are sounding the alarm.

If the NSA is publicly worried, you know it’s bad. Update: Cloudflare says they are not vulnerable, “We responded quickly to evaluate all potential areas of risk and updated our software to prevent attacks, and have not been able to replicate any external claims that we might be at risk.” The company published a blog post on the matter.

Link

Co-Founder of Swiss SMS Giant 'Mitto AG' Accused of Government Surveillance

Andrew Orr ·

Swiss tech company Mitto AG is trusted by companies such as Twitter and Google to deliver SMS security codes to users, appointment reminders, sales promotions, and more. It’s co-founder and COO Ilja Gorelik has been accused of selling access to Mitto’s networks for surveillance.

The existence of the alternate service was only known to a small number of people within the company, these former employees said. Gorelik sold the service to surveillance companies which in turn contracted with government agencies, according to the employees.

Link

Microsoft Seizes Domains From Chinese Group 'NICKEL' Used to Attack Governments

Andrew Orr ·

NICKEL is a China-based threat actor that targets governments, diplomatic entities, and NGOs around the world. Microsoft’s Digital Crimes Unit has disrupted their operation.

MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. NICKEL actors created and deployed custom malware that allowed them to maintain persistence on victim networks over extended periods of time.

Link

Hundreds of Tor Servers From 'KAX17' Threaten to Deanonymize Users

Andrew Orr ·

Security researcher ‘Nusenu’ has uncovered hundreds of Tor servers belonging to an entity tracked as KAX17.

Grouping these servers under the KAX17 umbrella, Nusenu says this threat actor has constantly added servers with no contact details to the Tor network in industrial quantities, operating servers in the realm of hundreds at any given point.

KAX17’s focus on Tor entry and middle relays led Nusenu to believe that the group, which he described as “non-amateur level and persistent,” is trying to collect information on users connecting to the Tor network and attempting to map their routes inside it.

Link

Cuba Ransomware Gang Made $43.9 Million in Ransom Payments

Andrew Orr ·

The FBI also said it traced attacks with Cuba ransomware to systems infected with Hancitor. This is a malware operation to access Windows machines.

It is also worth mentioning that Cuba is also one of the ransomware groups that gather and steal sensitive files from compromised companies before encrypting their files. If companies don’t pay, the Cuba group will threaten to dump sensitive files on a website they have been operating on the dark web since January this year.

Link

Ubiquiti Developer Arrested and Charged With Extortion

Andrew Orr ·

Former Ubiquiti employee Nickolas Sharp has been arrested and charged with data theft and extortion.

As alleged, Nickolas Sharp exploited his access as a trusted insider to steal gigabytes of confidential data from his employer, then, posing as an anonymous hacker, sent the company a nearly $2 million ransom demand.

Link

Hackers Steal $119 Million From Web3 Project 'BadgerDAO'

Andrew Orr ·

BadgerDAO reported on Wednesday that it lost about 2,100 bitcoin and 151 ether in a hacking attack.

Kryptobi, who said he is on the BadgerDAO support team and has been looking into the hack, told Motherboard that it appears someone injected a malicious script into BadgerDAO’s frontend after compromising an API key for BadgerDAO’s Cloudflare account. Cloudflare is a web infrastructure, content delivery network, and website security company, which is used by millions of sites on the internet.

Link

Planned Parenthood Hack Leaked Data for 400,000 Patients

Andrew Orr ·

In October, a Planned Parenthood facility in Los Angeles suffered a data breach. It affected about 400,000 patients.

Letters from PPLA to affected patients warned that “we identified files that contained your name and one or more of the following: address, insurance information, date of birth, and clinical information, such as diagnosis, procedure, and/or prescription information.”

Link

Facebook Requires More At-Risk Accounts to Use Two-Factor Authentication

Andrew Orr ·

Wired writes that Facebook will require at-risk accounts to secure with two-factor authentication, an important security measure for users.

Facebook Protect started as a pilot project in the United States ahead of the 2018 midterm elections and expanded leading up to the 2020 presidential election. Facebook enrolls some prominent public figures in the program automatically, but the company has also been creating mechanisms for people to nominate themselves for inclusion, like enrolling whole newsrooms. Once users join Facebook Protect, they can’t opt out.

Link

Qualcomm's New Snapdragon Chip Aims to Defeat Cops and Robbers

Andrew Orr ·

A report from PCMag today discusses Qualcomm’s latest chip, the Snapdragon 8 Gen 1. It has anti-spoofing technology to protect against Stingrays.

Spoof cell sites can now be run on small, widely available boxes that pass bad data and phishing messages, Qualcomm said at its Snapdragon Summit today. Otherwise known as “Stingrays,” these faux cells can be run by criminals, law enforcement, or security agencies to collect your personal data without your permission.

Link

'EWDoor' Malware Attacks Thousands of AT&T Internet Subscribers

Andrew Orr ·

Hackers are exploiting a bug from 2017 to attack the EdgeMarc Enterprise Session Border Controller. This device is used by businesses to manage phone calls and video calls.

The vulnerability being exploited to infect the devices is tracked as CVE-2017-6079, a command-injection flaw that penetration tester Spencer Davis reported in 2017 after using it to successfully hack a customer’s network. The vulnerability stemmed from an account in the device that, as Davis learned from this document, had the username and password of “root” and “default.”